Scanning your site for malware in cPanel: what Imunify finds and what to do with the result

Security··· 127 views· 4 min read

The short answer: cPanel has a tool called Imunify360, in the Security group, that scans your account’s files for malicious code (malware). You can order a scan whenever you like and see the list of what it flagged. It is for finding out there is a problem; what you do next decides whether the site is clean for good.

How to use it

1 In cPanel, look for the Imunify360 icon in the Security section and open it.
2 Find the malware scanning area (Malware Scanner). You will see the list of files the tool flagged and the state of each, or a note that it found nothing.
3 Order a scan when you suspect something, rather than waiting for the next one. How long it takes depends on how many files the account has.
4 For each flagged file, note the path, the threat type’s name and the date. Writing this down is the most useful thing you can add to a support request.

What each button does, namely whether the tool cleans the files for you, depends on the version and licence installed on the server. If a clean-up button is disabled or missing on your account, open a ticket: we will handle it or tell you what to do by hand.

What to do with the result

What you see What to do
Nothing found, but the site behaves strangely (redirects, shows ads) An automatic scan does not catch everything. See The scan says clean but the site still redirects.
Files from plugins, themes or WordPress core flagged Often the fix is to reinstall the clean version from the official source, rather than cleaning by hand.
A flagged file in an images or uploads folder (uploads) .php files in an images folder are almost always suspect.
Several files in several folders There is probably an open door (stolen password, outdated plugin). Cleaning without closing it is pointless.

After the clean-up

1 Change the passwords: cPanel, FTP, database, WordPress administrator. See Changing the WordPress administrator password.
2 Update WordPress, plugins and themes, and delete the ones you do not use. See An abandoned plugin or an old PHP version.
3 Switch on two-step verification wherever you can: How to enable two-factor authentication.
4 If you must put a copy back, choose one from before the infection: After a hack, which backup do you restore.
Do not delete blindly. Before removing files the tool flagged, take a copy of the account: a false alarm on one of your program’s files can break the site. And a scanning tool does not replace prevention: updates, strong passwords and backups.

Did the scan flag files and you do not know what to do? Open a ticket with the domain and the list of paths you saw.

Open a support ticket

Where to see it in your account

  • The scanner. Look for Imunify360 in the Security section of cPanel. What you see there, including whether a clean-up button is active, is what is available on your account; if it is missing, open a ticket.
  • A clean point to go back to. Every shared plan makes an automatic daily backup, with restores at no cost. JetBackup (or Backups) in cPanel lists the restore points: choose one from before the first date on your list of flagged files.
  • Signs besides the scan. Resource Usage can show CPU or process spikes nobody asked for, and the Statistics sidebar shows a sudden jump in files. Neither proves an infection, but both are worth noting in the ticket.
  • On a VPS. You have full SSH access and look after security yourself, so do not expect the cPanel Security section there.

SEE ALSO

The scan says clean but the site still redirects: where an infection hides

After a hack, which backup do you restore? Choosing a clean copy

Changing the WordPress administrator password

ModSecurity and web application firewalls: what they do, and what to do when one blocks you

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from KSh858.00/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 1,659 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 1,494 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 2,484 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 1,616 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 1,587 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 105 SQL injection and XSS in plain words: what to ask your developer The short answer: SQL injection and XSS are two of the oldest attacks on websites, and they still work because they come...